AtomPub and OAuth

[Stephen Paul Weber]

So, I'm still trying to get AtomPub working with OAuth and I think
I've found the problem : I need to use the Authorization: header form
of OAuth (since I must POST the data I cannot use a GET string for
OAuth and I cannot put it in the POST body, since that is expected to
be raw XML) but my host (Dreamhost) runs PHP in CGI mode and so I do
not have access to the Authorization: header... hmm... this is a
pickle.

--
- Stephen Paul Weber (Singpolyma)

Web: http://singpolyma.net/
Twitter: http://twitter.com/singpolyma
IM: singp...@gmail.com

[Steve Ivy]

So in CGI mode you can't do header("Authorization: $stuff") ?

--
Steve Ivy
http://redmonk.net // http://diso-project.org
This email is: [ ] bloggable [x] ask first [ ] private

[Joseph Scott]

On Apr 25, 3:15 pm, "Stephen Paul Weber" <singpol...@gmail.com> wrote:
> So, I'm still trying to get AtomPub working with OAuth and I think
> I've found the problem : I need to use the Authorization: header form
> of OAuth (since I must POST the data I cannot use a GET string for
> OAuth and I cannot put it in the POST body, since that is expected to
> be raw XML) but my host (Dreamhost) runs PHP in CGI mode and so I do
> not have access to the Authorization: header... hmm... this is a
> pickle.

Unfortunately this is a problem for AtomPub in general, relying on the
ability to access the HTTP Auth header.

http://joseph.randomnetworks.com/archives/2007/09/19/http-basic-authentication-a-tale-of-atompub-wordpress-php-apache-cgi-and-ssltls/

I saw your comment on this post earlier, so I know you already know
this :-)

I've only briefly gone over some of the OAuth docs, but if it relies
on this same HTTP header, then it's in for the same problems that the
AtomPub folks are having.

--
Joseph Scott
jos...@randomnetworks.com
http://joseph.randomnetworks.com/

[Stephen Paul Weber]

It does not normally rely on this header, but in the context of
AtomPub when there is no access to the POST data (since it must be
XML) and OAuth will not use the query string if you use HTTP method
POST - then we need the header.

--